We are developing AppExchange product where we need to communicate with different third party systems.For Instance , we are getting services from 5 different third party system,a user can have 5 credentials accordingly. In such cases , where can we store the credentials and related fields of the users.
It depends on a few things.
If the external systems are going to authenticate with OAuth, then Named Credentials are great. They are secure (even your own code can't get the secret values directly), and handle OAuth out-of-the-box.
However, Named Credentials are not well documented for the OAuth use-case (and not very configurable if anything unusual is required). So, if it doesn't just work, you may run into something that makes that method impossible to use.
In principal, Named Credentials can be used to log into external system with a simple username/password authentication. The hard part is that you can't easily provide your own UI to allow users to set up their details. See Is it possible to set per user Named Credentials via Apex? or a good but complicated way and Possible to update NamedCredential from Apex? for a quick + dirty way.
The tried and tested method is to use protected custom settings. When you define a custom setting in your package as protected, the subscriber org cannot read it except via your code. So, you can provide an UI in Lightning and/or VF so that they can enter their details. The user's private detail are protected from everyone else in the subscriber org, but bugs in your code could allow them to leak out. This is the method that has been used for years and is acceptable to Salesforce's security review team for listing on AppExchange.